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(TS//SI//REL)VPN SigDev 
Basics 




S31244 - OTTERCREEK 
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UNCLASSIFIED 






(U) What is a VPN? 

• (U) A Virtual Private Network or VPN is a 
computer network that uses encryption to 
securely connect remote users/networks over 
an otherwise insecure network, usually the 
public internet. 

• (U) Common Types: 

- PPTP, IPSec, SSL 

• (U) Public Key Encryption 

° Diffie-Hellman, RSA 



UNCLASSIFIED 




UNCLASSIFIED 






(U) PPTP 

• (U) Microsoft Point-to-Point Tunneling 
Protocol 

• (U) Control Channel 

- TCP port 1723 

• (U) Data Channel 

° GRE-Next Protocol 47 

• (U) RFC 2637, RFC 3078 



UNCLASSIFIED 




UNCLASSIFIED 






(U) IPSec 



• (U) Authentication 

° Pre-shared key (PSK) or Public key certificates 

• (U) ISAKMP/IKE packets are used for key exchange 
and to establish the secure connection 

□ UDP port 500, 4500; TCP port 500 

• (U) ESP packets contain the encrypted data 

° IP Next Protocol 50; UDP port 500 

• (U) RFC2402, RFC2406, RFC2409, RFC4306, RFC2408 



UNCLASSIFIED 




UNCLASSIFIED 



(U) IPSec in a nutshell 

Phase 1 




UNCLASSIFIED 





UNCLASSIFIED 






(U) SSL/TLS 



• (U) Secure Sockets Layer/Transport Layer 
Security 

• (U) WARNING! e-commerce = tons of 
uninteresting SSL traffic 

• (U) Common ports: TCP ports 443, 995 

• (U) RFC2246, RFC4346, RFC5246 




UNCLASSIFIED 




(U) SSL in a nutshell 
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Public Key 
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(U) SSL Exchange 

i. Client connects to server 

2 Server sends cert to client 

3 Client validates cert 

4 Key exchange 

5. Pass encrypted material 

T 
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(TS//SI/REL) Who works VPNs? 



(TS//si//REL) VPN Working Group (go vpn) 



S2, SSG, CES (OTTERCREEK, NSP, S31322, S3117, 
S3112), TAO, etc. 



(ts//si//rel) Alias: 

(Board alias: 



I) 



(ts//si//rel) Meets every other Thursday at 1300 
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(TS//SI/REL) Who works VPNs? 
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(TS//SI//REL) So you think your 
target is using a VPN... 
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L 



(TS//SI//REL) SigDev Tools 



(TS//REL) VPN Specific 

• BLEAK I NQU I RY 

DISCOROUTE 

TOYGRIPPE 



(ts//rel) Also useful 

• MARINA 

• MASTERSHAKE 

• NKB 

• PIN WALE 

• RENOIR 

• TREASUREMAP 

• TUNINGFORK 
XKEYSCORE 
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(TS//SI//REL) TOYGRIPPE 

• (ts//si//rel) Database of VPN metadata 

° IPSec, PPTP, ViPNet 
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TOP SECRET//COMINT//REL TO 



Standard Form - Mozllla Flrefox 



Rle Edi: View History Bookmarks Tools Heb 

$ ❖ - ^3 Q A 

!*XKEYSCORE j"OYGRIPPE NKB: Home T^NKB Disco Route Jf Roadoed.net MyPage gGold^oint 



Sfc XK Results 
♦ Logoff 
Query 

♦ standard 

♦ FreeForm 

Results 

♦ AliResults 

♦ view 

♦ Excel 

♦Text 

Delimited 

Preferences 

♦ General 

Help 

♦ fao 



i Standard Form 



Execute Clear Al 



Date Range(Required): 



1 4 $| / fl tl / 1 2011 tl - |oo tf : °l ^ 



^"Stecond level 
eve 



3Brd 



[Display Fields: 



pfcfol | 0\/0| 




TOP SECRET//COMINT//REL TO US) 



AUS, CAN, GBR, NZL 




(ts//reuTYG Tips: 

0 Populate “Display 
Fields" 

0 For both directions 
between 2 Ips, use 

AND 

0 For either direction 
connecting to a 
single IP, put IP in 
both "Source" and 
"Destination" boxes, 
and use OR 



AUS, CAN, GBR, NZL 
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Query Results - Mozilla Flrefox 



RIG Edit View History Bookmarks Tools Help 

.VXKEYSCORE QTOYGRIPPE >NKB:Home ""^NKB Disco Route ^ Roadbed.net MyPage 
XK Results 



Master text sty es 



•ogle 



_x | ® Query Results Q 



TS//SI//REL TO USA, FVEY 



2011-04-02 C82838.0 



TS//SI//REL TO USA, FVEY 


2011-04-02 09:13:14.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 lOQlO.O 


KpA^aqoij/ii^poJ 


>UjJ]-260|> 


Au 




TS//SI//REL TO USA, FVEY 


2011-04-02 11-31:53.0 


KbA^O(I)l|^docn|jj|]-26o| 


V 


c 


TS//SI//REL TO USA, FVEY 


2011-04-03 12:22:03.0 


KLDAB00001M1100 | UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 01:08:00.0 


K^ABO(fuyngO| u|j-projr 


fn 


pwp 


TS//SI//REL TO USA, FVEY 


2011-04-03 01:54:35.0 


kldaboAoii^wGo^ 


Ulb-leofr 


IKEvl * 




TS//SI//REL TO USA, FVEY 


2011-04-03 03:24:56.0 


KLDAB00001M11QJL 


,UKjJ60D 


,f vl l ,■ 


" ,^i 


TS//SI//REL TO USA, FVEY 


2011-04-03 04:58:08.0 


KLDABOOOOlMllfr 


wt4 


V 1 € 


*VGI 


TS//SI//REL TO USA, FVEY 


2011-04-01 11:37:49.0 


KLDAB00001M1100 


UKJ-260D 


ESP 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-01 17:37:33.0 


KLV125899750000 


US-966E 


ESP 


DE 


TS//SI//REL TO USA, FVEY 


2011-04-01 12:51:08.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-01 00:08:15.0 


IRS1037 


DS-300 


ESP 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-01 00:23:25.0 


IRS1037 


DS-300 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 05:41:27.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 06:25:53.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 07:56:09.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 08:42:05.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 09:32:55.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 10:16:16.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 10:59:38.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 11:50:29.0 


IR1S035 


DS-200B 


IKEvl 


DE 


TS//SI//REL TO USA, FVEY 


2011-04-03 12:34:43.0 


IR1S035 


DS-200B 


IKEvl 


DE 


TS//SI//REL TO USA, FVEY 


2011-04-03 12:34:45.0 


IR1S035 


DS-200B 


IKEvl 


DE 


TS//SI//REL TO USA, FVEY 


2011-04-03 12:34:44.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 01:23:51.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-03 13:23:50.0 


IR1S035 


DS-200B 


IKEvl 


DE 


TS//SI//REL TO USA, FVEY 


2011-04-03 13:23:51.0 


IR1S035 


DS-200B 


IKEvl 


DE 


TS//SI//REL TO USA, FVEY 


2011-04-02 06:52:02.0 


KLDAB00001M1100 


UKJ-260D 


ESP 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 05:07:51.0 


KLDAB00001M1100 


UKJ-260D 


ESP 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 06:16:31.0 


KLDAB00001M1100 


UKJ-260D 


ESP 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 07:48:23.0 


KLDAB00001M1100 


UKJ-260D 


ESP 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 05:34:51.0 


KLDAB00001M1100 


UKJ-260D 


ESP 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 00:18:42.0 


KLDAB00001M1100 


UKJ-260D 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 00:01:51.0 


KLDAB00001M1100 


UKJ-260D 


ESP 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 00:18:41.0 


IRS1037 


DS-300 


IKEvl 


IR 


TS//SI//REL TO USA, FVEY 


2011-04-02 00:16:51.0 


IRS1037 


DS-300 


ESP 


IR 




DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 




IR 




DE 




DE 




DE 




DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


DE 


pre-shared key 


IR 


pre-shared key 


IR 


pre-shared key 


IR 




DE 


pre-shared key 


DE 


pre-shared key 


IR 


pre-shared key 


IR 




DE 




DE 




DE 




DE 




DE 




DE 




DE 




DE 




DE 





0 (U) Export 
results to 
excel or 
text doc for 
easier 
sorting. 
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(TS//SI//REL) XKEYSCORE 



(ts//rel) Fingerprints 

• IPSec 

° vpn/esp 
° vpn/isakmp 

• PPTP 

° vpn/pptp* 

• SSL 

° network_encyption/ssl 



(TS//REL) Search Forms 

• Start with FULL DNI 

° vpn/* 

" networkencrytion/* 

• IPSec 

° IKE Parser 

• SSL 

° SSL Parser 
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XK Search: Full Log - Mozllla Firefox 



Fjle Ecit View History Bookmarks Tools Help 



VXKEYSCORE ^TOYGRIPFE > NKB: l-one ~^NKB Disco Route Roadbed net MyPace (#| GoldPoint 



[[Gl^ | Tr 



XK Search: Ful Log 



x |®| Standard Form 



^^^^ThB^Bterr^audite^oMISSI^^n^lLMiBiUJiahtoAc 

TOPSECRET COMINT REL TO USA. AUS. CAM. GBR. a 



KKEYSCORE Welcome srwils2! Warning: your password las expired! 

vr^Hcme 0^ Seaxh ^ Workflow Centra Results pj Fingerprints |^| Satisfies @Map § My Account ^XK Forum 

Show/Hide Fields’ Advarcej Fealures* Show hidden Search Fields Clea Searih Values Reloac Last Search Values 



Log Out 



| Nai/igatlon Filter Baa 



2 Search Wzaid 

bDcne 

tl 0 Classic 
fl □ Mu hi Search 

3 0 Classic AM 

£1 Alert 
21 BlackEeny 
iS Call Logs 
21 Category DN 
21 Cellular CNI 
21 Cisco Passwords 

2 Clarent 

21 DNS 

2 Documenl Metadata 
(El Documenl Tagg ng 
2 Email Addresses 
2 Extracted Files 
2 Full Log CNI 
2 Geo Ilf o 
2 HTTP Activity 
2|KEPa 5 er 
2 Keylogger 

21 Log ns and Fassword: 
2 Machine Info 
2 Micioplug n Metadata 
2 Obfuscation(Munged ' 
a Q Classic N-Z 

2 Network Information 
2 Network Logs 
2 PILBEAM 
2PPF VolPMetacata 
2 Passports from Imager 
2 Phene Number Extrac 
2 RBGAN 
El RTF 

2RaciusLcgs 

2Registiy 

BSIP 

2 SSF Parser 
2 SSL Parser 
2 Shellcode 
IlTDI 

2TIP0FF Collection 
2 Topic / Tech Strings 
2 User Activity 
2 User Activity (New/Exd — 



Search: Full Log • 



Q 



CS//SI//REL) Lsokirg fo' 
traffic to perfDrn 
vulrerability assessment. 



Recent JLStilications 



Additional justification: 



Miranda Number; 



Gunent Time: 2011 -04-04 1 4:04:04 GMT 
i I Start: 



1 1Da y 



>11-34-03 ” 00:00 y Stop: 2011-04-05 3 00:00 y W 



Client IP (X-Fowandec-For): 



< [P Address Field Builder] 



WLAN Chanrel: 



WLAN SMAC: 



Active User<realm>: 




address Field Builder] 





^ ThBar^- L audited brUSEIDI 8 and Hutbii Rights Actconpliance 




Done 




§ 
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XK Search: Full Log - Mozilla Firefox 



File Edit View History 3ookmarks Tools Help 
fcXKEYSCORE ^ITOYGRIPPE >NKB:Home 71 NKB Disco Route Roadbed.net MyPage 




TOP SEC RETvCOMINT v REL TO USA, AUS, CAN. GBR. and NZL 20320" 



XKEYSCORE Welcome srwils2! Warning: your password has expired! Log Out 



^ Home ^Search It Workflcw Central Results Finge prints 0 Statistics Q)Map *§ My Account VxK Forum 



Navigaton Filtei 



Baal 



51 Search Wizard 

bQcne 

d 0 Classic 

S □MultiSearch 
30 Classic A-M 
2 Alert 
2 BlackBeriy 
5] Call Logs 
51 Category DNI 
£1 Cellular DNI 
5) Cisco Passwords 
51 Clarent 
SDNS 

S Document Metadata 
5 Document Tagging 
5 Emai Addresses 
S Extracted Files 
S Full Log DNI 
51 Geo Info 
5 HTTP Activity 
S IKE Parser 
S Keylogger 
5 Logirs and Password: 
5| Machine Info 
51 Micrcplugin Metadata 
51 OMuscation(Munged 
a 0 Classic \FZ 

5| Netwark Information 
5] Netwirk Logs 
5 PILBEAM 
51 PPF VoIP Me la data 
51 Passports from Image 
5] Phone Number Extrao 
51 RBGAN 
5 |rtp 

51 Radius Logs 
51 Registry 
51 SIP 

51 SSH Parser 
5] SSL Parser 

51 Shellcode 
5)TDI 

5]TIPOFF Collection 
SI Topic/ Tech Strings 
51 User Activity 
51 User Activity (New/Ex| 



| From 1 1 



Port: 

Couitry: 
Couitry: 
City (IP): 
City (IP): 
Latitude (IP): 
Latitude (IP): 
Longitude (IP): 
Longitude (IP): 

Map Field Builder legions (IP): 

Oute-TunnellP Address: 
Oute-TunnellP Address: 
Outer Tunnel Port: 
Outer Tunnel Port: 

Application Type*: 
Ap p I fc atio r 



Applica:ion: 



ApsID (+Fingerprints)* ftulltextl : 



L 



!LS AND !GB AND !CA AND !NZ AND !AU v [ From *] □ One side is not 5-eyes 



!LS AND IGB AND !CA AND !NZ AND IAU 



* | To 1 1 ® 0 Both sides are not E-eyes 



_] 1 From i ] 



D li? El 



_| | From i | 

3 l T ° *1 



© [Map Field Builderl 



| f From t | IIP Address Fielc Builderl 



| TO i | *•> IIP Address Fielc Builder! 



_| I From i | 



II IJO 



7> 



• [Populate wilh Field Builderl 

• Populate with Tree Field Builderl 






j®y 



0 (ts//rel) For initial 
searches, you may 
want to leave this 
blank to see all of 
the different kinds 
of traffic are found 
on the IP pair. 



audted for USSID 1 8 end Hunan R 
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_vpn - Mozilla Firefox 



File Edit View History Bookmarks Tools Help 

<* » - <%> Q MS 

:«XKEYSCORE ^TOYGRIPPE NKB Home T^NKB Disco Route Roadbed.net MyPage ©GoldPoint 

248823681254 x 



Google 



!«£ XK Metaviewer: 84,11,25.13... x c| Standard Form 



x NKB Disco Route 



f @ https ://ncmd...; 






This system isaidited forUSSIDI 8 and Human Rg his Act comp lance 

TOP SECRET COMINT7REL TO USA, AUS, CAN. GBR. NZL 



4 ^ Home Sean: t 9 Workflow Central [[]y Results Fingerprints H Statistics ^ Map ^ My Account XK Forum 



XKEYSCORE Welcome srwils2! Warning: your password has expired! Log Out 



[5| Search Wizard 
a □ CNE 
a Q Classic 
9 □ MultiSearch 
a 0 Classic A-M 
S Alert 
g BlackBery 
g Call Logs 
g Category DNI 
g Cellular DNI 
g Cisco Passwords 
g Clarent 
SDNS 

g Document Metadata 
g Document Tagging 
g Email Addresses 
|g Extracted Files 
g Full Log DNI 
g Geo Info 
g HTTP Adivity 
g IKE Parser 

5 Key logger 
g Logins aid Password! 
g Machine Info 
g Microplugin Metadata 
g Obfusca1ion(Munged 1 
a Q Classic N-Z 

g Network nformation 
g Network .ogs 
g PILBEAW 
SPPF VoIP Metadata 
g Passports from Image: 
g Phone Number Extrac 
g RBGAN 
gRTP 

g Radius Logs 
g Registry 
SI SIP 

g SSH Parser 
g SSL Parser 
a Shellcode 

Htdi 

gTIPOFF Collection 
g Topic / Tech Strings 
g User Activity 
g User Activity (New/Ex| 



EL 



N Help Actions T Reports T 



© Map View 



: Sigad 


▼ Casenotation 


Datetime 


Datetime E Fm Port 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:00:52 


2011-0403 0 0 1 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:03:52 


2011-04030 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:06:52 


20110403 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:09:52 


2011-0403 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-0463 00:12:52 


201104030 0 


UKJ-260D 


KLDAB00001M1100 


2011-040300:15:52 


20114)4030 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:18:52 


20114)403 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:21:52 


2011-04-03 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:22:01 


20114)4-03 0 500 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:24:52 


2011-04030 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:27:52 


20114)403 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:30:52 


201104030 0 


UKJ-260D 


KLDAB00001M1100 


2011-040300:33:52 


20114)4030 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:36:52 


20114)44)3 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:39:52 


2011-04-03 0 0 


UKJ-260D 


KLD AB00001M 1100 


20114)403 00:42:52 


2011-044)3 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-040300:45:52 


2011-0403 0 0 


UKJ-260D 


KLDAB00001M1100 


20114)403 00:51:52 


20114)403 0 0 


UKJ-260D 


KL D A B00001M 1100 


2011-0403 00:54:52 


201104030 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 00:57:52 


2011-0403 0 0 


UKJ-260D 


KLDAB00001M 1100 


20114)403 01:00:52 


201104030 0 


UKJ-260D 


KLD AB00001M 1100 


20114)403 01:06:31 


20110403 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-0403 01:07:58 


20110403 0 500 


UKJ-260D 


KLDAB00001M1100 


2011-040301:09:53 


201104030 0 


UKJ-260D 


KLD AB00001M 1100 


2011-0403 01:12:53 


2011-0403 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-040301:15:53 


201104030 0 


UKJ-260D 


KLD AB00001M 1100 


20114)40301:18:53 


201104030 0 


UKJ-260D 


KLD A B00001P.1 1100 


20114)40301:21:53 


201104030 0 


UKJ-260D 


KLDAB00001M1100 


20114)403 01:24:53 


20110403 0 0 


UKJ-260D 


KLDAB00001M1100 


20114)403 01:30:53 


20110403 0 0 


UKJ-260D 


KLDAB00001M1100 


2011-040301:33:53 


201104030 0 


UKJ-260D 


KLDAB00001M1100 


20110403 01:36:53 


20110403 0 0 


UKJ-260D 


KLD AB00001M 1100 


2011-040301:39:53 


2011-04030 0 


UKJ-260D 


KLD AB00001M 1100 


20114)40301:42:53 


201104030 0 


UKJ-260D 


KLDAB00001M1100 


20114)403 01:45:53 


20110403 0 0 
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To Cou To City (IP) To Port Application 
vpn/esp 
ypnfesp 
vprt/esp 




ypn/esp 

vprVesp 

ypnfesp 

vpn/esp 

vpn/isakmp 

vprt/esp 

ypn/esp 

ypnfesp 

vpn/esp 

ypnfesp 

ypnfesp 



ypnfesp 

vpn/esp 

ypnfesp 

ypnfesp 

ypnfesp 

vprt/esp 

vprtfisakmp 

ypnfesp 

vprt/esp 

ypnfesp 



AppID (+Fingerprints) 

vpn/esp nacfvprtfprotocoifesp 



ypnfesp nac/vprt/prolocolfesp 

ypnfesp nac/vpnfprotocolfesp 
vpn/esp nac/vpn/protocoifesp 
vpn/esp nacfvpnfprotocoifesp 
ypnfesp nacfvprtfprotocoifesp 

vpnfisakmp vpnfipsec/isakmp/main mode/kev exchange message vprtlire 4 vpn/isakmp content 

ypn/esp nacfvprtfprotocoifesp 

ypnfesp nacfvpn/protocolfesp 

ypnfesp nacfypnfprotocolfesp 

vpn/esp nacfvpnfprococolfesp 

ypnfesp nacfyprVprotocol/esp 

vpn/esp nac/ypn/protocolfesp 

ypnfesp nac/vpnfprotocotfesp 

ypnfesp nacfypnfprotocolfesp 

ypnfesp nacfypnfprotocolfesp 

ypnfes p nac/ypn/protocolfesp 

ypnfesp nac/ypn/protocolfesp 



ypnfesp nacfvprtfprotocoifesp 

vpnfisakmp vprtfipsecfisakmpfrmin mode/kev exchange message vptVire 4 vprtfisakmp content 
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